kevlened / msrcrypto Goto Github PK

The following works on browser webcrypto but not when using msrcrypto, it throws an error with message about "keyData". I've tested both in browser and in expo react native in both it throws the same error.

try {
    await crypto.subtle.importKey(
      "raw",
      new Uint8Array([1, 1, 2, 2, 1, 1, 2, 2, 1, 1, 2, 2, 1, 1, 1, 1]),
      "AES-GCM",
      false,
      ["encrypt", "decrypt"]
    );
  } catch (e) {
    console.log(e.message);
  }

The error from expo

[Unhandled promise rejection: Error: keyData]
- node_modules/msrcrypto/dist/msrcrypto.js:9130:28 in buildParameterCollection
- node_modules/msrcrypto/dist/msrcrypto.js:9174:38 in executeOperation
- ... 12 more stack frames from framework internals

related-to: #5

If I pass "false" to the extractable parameter in importkey an error is thrown at line 9112
with the message "extractable"

looking at the code the problem seem to be here:

the correct way to check if a variable is present would be to check if it is ===undefined otherwise you don't allow "false" as a valid value

HMAC algorithm length during generateKey is in bits, msrCrypto currently generates bytes instead.

See the diff between msrCrypto and other conforming implementations.

Correct (e.g. chromium)

Incorrect (current behaviour)

Thank you for maintaining this library's version in the node ecosystem.
As you may have seen, due to some vulnerabilities our team found in the original Microsoft library, we worked through coordinated disclosure with Microsoft and this has resulted in fixes being applied and made public in CVE-2018-8319.
As they have numbered the fixed version 1.4.1 (see https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319), which "collides" with the versioning you have currently in this package, I suggest updating the NPM package to the new (secure) code available from Microsoft to help the downstream projects consuming this NPM library from using the insecure versions of the code.
Please feel free to contact me here or offline if you have questions.

How hard would it be to add pbkdf support by taking this:

https://github.com/PeculiarVentures/webcrypto-liner/tree/master/src/mechs/pbkdf

maybe some pointer how and where I can try to integrate it